release v4.1.0

https://github.com/fphammerle/docker-onion-service/commit/46ca6d70fb2d4570bfddac6b3f5e485183e72405
https://github.com/fphammerle/docker-onion-service/commit/aa124bde955047b2de6316ff72d6b1f76d14e3ba

CHANGELOG.md

@@ -6,6 +6,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [4.1.0] - 2021-03-03
+### Added
+- enabled transparent proxy, listening on port `9040` (requires netfilter rules)
+- image labels:
+  - `org.opencontainers.image.revision` (git commit hash via build arg)
+  - `org.opencontainers.image.source` (repo url)
+  - `org.opencontainers.image.title`
+
 ## [4.0.0] - 2021-01-01
 ### Changed
 - healthcheck: replace periodic http requests with probing
@@ -55,7 +63,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 - tor socks5 & DNS proxy
 
-[Unreleased]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.0.0...HEAD
+[Unreleased]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.1.0...HEAD
+[4.1.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v4.0.0...v4.1.0
 [4.0.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v3.0.0...v4.0.0
 [3.0.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v2.1.0...v3.0.0
 [2.1.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v2.0.0...v2.1.0

Dockerfile

@@ -1,6 +1,6 @@
-FROM alpine:3.12.3
+FROM docker.io/alpine:3.13.2
 
-ARG TOR_PACKAGE_VERSION=0.4.3.7-r0
+ARG TOR_PACKAGE_VERSION=0.4.4.7-r1
 RUN apk add --no-cache tor=$TOR_PACKAGE_VERSION
 VOLUME /var/lib/tor
 
@@ -27,3 +27,9 @@ HEALTHCHECK CMD \
         | grep -q network-liveness=up \
     && nslookup -port=9053 google.com localhost | grep -v NXDOMAIN | grep -q google \
     || exit 1
+
+# https://github.com/opencontainers/image-spec/blob/v1.0.1/annotations.md
+ARG REVISION=
+LABEL org.opencontainers.image.title="tor socks, dns & transparent proxy" \
+    org.opencontainers.image.source="https://github.com/fphammerle/docker-tor-proxy" \
+    org.opencontainers.image.revision="$REVISION"

Makefile

@@ -0,0 +1,32 @@
+IMAGE_NAME := docker.io/fphammerle/tor-proxy
+PROJECT_VERSION = $(shell git describe --match=v* --abbrev=0 --dirty | sed -e 's/^v//')
+TOR_PACKAGE_VERSION = $(shell grep -Po 'TOR_PACKAGE_VERSION=\K.+' Dockerfile | tr -d -)
+ARCH = $(shell arch)
+# architecture[arm_variant]
+# https://github.com/opencontainers/image-spec/blob/v1.0.1/image-index.md#image-index-property-descriptions
+IMAGE_TAG_ARCH_aarch64 = arm64
+IMAGE_TAG_ARCH_armv6l = armv6
+IMAGE_TAG_ARCH_armv7l = armv7
+IMAGE_TAG_ARCH_x86_64 = amd64
+IMAGE_TAG_ARCH = ${IMAGE_TAG_ARCH_${ARCH}}
+IMAGE_TAG = ${PROJECT_VERSION}-tor${TOR_PACKAGE_VERSION}-${IMAGE_TAG_ARCH}
+BUILD_PARAMS = --tag="${IMAGE_NAME}:${IMAGE_TAG}" \
+	--build-arg=REVISION="$(shell git rev-parse HEAD)"
+
+.PHONY: worktree-clean docker-build podman-build docker-push
+
+worktree-clean:
+	git diff --exit-code
+	git diff --staged --exit-code
+
+docker-build: worktree-clean
+	sudo docker build ${BUILD_PARAMS} .
+
+podman-build: worktree-clean
+	# --format=oci (default) not fully supported by hub.docker.com
+	# https://github.com/docker/hub-feedback/issues/1871#issuecomment-748924149
+	podman build --format=docker ${BUILD_PARAMS} .
+
+docker-push: docker-build
+	sudo docker push "${IMAGE_NAME}:${IMAGE_TAG}"
+	@echo git tag --sign --message '$(shell sudo docker image inspect --format '{{join .RepoDigests "\n"}}' "${IMAGE_NAME}:${IMAGE_TAG}")' docker/${IMAGE_TAG} $(shell git rev-parse HEAD)

tor-changelog.url

@@ -0,0 +1 @@
+https://gitweb.torproject.org/tor.git/plain/ChangeLog

torrc.template

@@ -1,3 +1,5 @@
+# https://www.torproject.org/docs/tor-manual.html.en
+
 # hide healthchecks:
 # > [notice] {CONTROL} New control connection opened from 127.0.0.1.
 Log [~control]notice warn stdout
@@ -14,5 +16,15 @@ DNSPort 0.0.0.0:9053
 SocksPort 0.0.0.0:9050
 SocksTimeout {socks_timeout_seconds}
 
+# requires netfilter rules
+# socks5 with auth-based circuit isolation (tor browser, torsocks --isolate) should be preferred
+# cave: IsolateDestAddr & IsolateDestPort are not enabled
+# https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TransparentProxy
+# https://github.com/epidemics-scepticism/writing/blob/b6733379d653b30771d578ace04c262600345122/misconception.md#transparent-proxying-lacks-context
+# https://lists.torproject.org/pipermail/tor-talk/2014-March/032507.html
+# https://gitweb.torproject.org/tor.git/tree/src/or/connection_edge.c?id=6285d9bdcf7f210c56abd25f75133e30d05a7473#n1423
+# https://github.com/mitmproxy/mitmproxy/blob/v6.0.2/mitmproxy/platform/linux.py#L27
+TransPort 0.0.0.0:9040 IsolateClientAddr IsolateClientProtocol
+
 # try to
 HardwareAccel 1